A path‑traversal flaw in the TAP 4 Multirepo Client of the go‑tuf library lets an attacker supply a repository name containing directory traversal sequences such as "../escaped-repo". When the library processes such a name it treats it as a filesystem path component and writes the root metadata file outside the intended LocalMetadataDir cache base, creating arbitrary files with the process’s permissions. This can compromise local files and, if executed with elevated privileges, lead to privilege escalation or code execution.

The Update Framework (go‑tuf) is affected. Vulnerable versions start at 2.0.0 and are fixed in version 2.4.1. Any installation of go‑tuf between these releases that accepts map files from untrusted sources is at risk.

The CVSS score of 4.7 indicates moderate severity, but the EPSS score of less than 1 % signals a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply a malicious map file to the application or otherwise control the repoName value; thus the attack vector is contingent on the application’s trust model, ranging from local to remote depending on how map files are obtained.